Red book content creation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:58 AM UTC
• Version: 1.0.2

Overview

The skill has a coherent Xiaohongshu content-generation purpose, but its local generator handles user text unsafely enough to warrant review before installation.

Review this skill carefully before installing. It does not appear intentionally malicious, but avoid running it on untrusted or sensitive input until the shell templating is replaced with safe escaping, browser rendering is sandboxed, and output retention plus CDN/network behavior are documented.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_content.sh:102

Finding

Arbitrary Command Execution Through GNU sed Program Injection

Content

View full analysis

` as an instruction to execute an operating-system command. This creates a direct path from a command-line title or content value to arbitrary command execution. The same interpolation also allows malformed input to corrupt the generated output or cause the script to fail, even when command execution is not attempted. ### Attack Path 1. An attacker supplies crafted content or a crafted title to `generate_content.sh`. 2. The input contains a replacement terminator, a newline, and a GNU `sed` `e` directive. 3. The script inserts the untrusted value into the `sed` expression at line 102 or 105. 4. GNU `sed` parses the injected newline as the start of another command. 5. The injected `e` directive executes an attacker-selected shell command. 6. The command runs with the operating-system identity and permissions of the user or a ...[truncated 936 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_content.sh:87

Finding

Unescaped User Content Injection Into Browser-Rendered HTML

Content

View full analysis

__CONTENT__

``` ```bash # 替换占位符 sed -i "s/__TITLE__/$TITLE/g" "$HTML_FILE" sed -i "s/__SUBTITLE__/$SUBTITLE/g" "$HTML_FILE" sed -i "s/__TAGS__/$TAGS/g" "$HTML_FILE" sed -i "s/__CONTENT__/$CONTENT/g" "$HTML_FILE" ``` ### Technical Analysis The generator places user-controlled content and title values directly into HTML without contextual escaping or sanitization. An attacker can close the existing `

` or `

` element and insert arbitrary markup. Potential injected elements include: - `

Remediation

View remediation

` as `>` - `"` as `"` - `'` as an appropriate entity 3. Use a maintained template engine with automatic contextual escaping rather than shell-based substitution. 4. If formatted HTML must be supported, sanitize it with a strict allowlist: - Permit only required formatting elements - Remove scripts and iframes - Remove all event-handler attributes - Reject dangerous URL schemes - Restrict or remove remote-resource URLs - Remove unexpected SVG and MathML active content 5. Configure the screenshot renderer defensively: - Disable JavaScript unless explicitly required - Disable local-file access - Block outbound network access or allowlist only required hosts - Run rendering in a sandbox or isolated container - Apply CPU, memory, execution-time, and output-size limits 6. Apply a restrictive Content Security Policy when browser preview is supported. 7. Add security tests covering element breakout, event handlers, script elements, remote images, iframes, and dangerous URL schemes. 8. Keep mathematical rendering data separate from executable JavaScript and never insert user-generated code into `KATEX_SCRIPTS`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

声明强调这是一个完整的小红书内容发布生成工具：输入原始 Markdown/纯文本后，AI 应生成适配小红书风格的多图 HTML 页面，并调用截图工具产出可直接发布的图片，还包括封面图、标题和摘要。实际代码仅是一个 shell 脚本模板填充器：创建输出目录，写入静态 HTML 模板，并把传入的 TITLE 和 CONTENT 以及未定义的 SUBTITLE/TAGS 替换进页面。代码没有调用任何 AI、生图或截图工具，没有生成多张页面，也没有处理 Markdown、提取摘要或自动配标题标签。因此其实际行为只是“生成简单单页 HTML”，与声明的主要能力和产出存在实质性差异。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

声明描述的是一个端到端的小红书内容生成工具：输入原始 Markdown/纯文本，AI 生成适配风格的 HTML 页面，再生成封面和内容截图，并配好标题摘要。而提供的代码只是一个截图脚本：读取已存在的 HTML 文件路径，调用 imgkit 生成封面和若干固定高度的内容截图。它没有任何文本解析、Markdown 转换、HTML 模板生成、AI 内容改写、标题生成或摘要生成功能。虽然“生成内容截图”这一子功能与声明部分一致，但代码的主要实际行为只是整个声明流程中的后处理步骤，因此描述不能准确代表这段代码实际做的事情。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation phrases are broad enough to overlap with ordinary user requests, which can cause the skill to trigger in contexts the user did not intend. Because this skill writes outputs and invokes screenshot tooling, over-broad routing increases the chance of unintended file generation or processing of sensitive content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill states that it will generate HTML and screenshots but does not clearly warn that files are written to disk in workspace/output locations. This can expose sensitive user content through residual local artifacts, unexpected storage, or later access by other processes or users sharing the environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The formula-rendering guidance instructs loading KaTeX resources from an external CDN without warning users that rendering may trigger outbound network requests. In a content-processing skill, this matters because user-provided content may be embedded in generated HTML, and external fetches can leak usage metadata, break offline expectations, or violate restricted-environment policies.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generated document forces the zh-CN locale in the HTML lang attribute, and the surrounding comments and output content are Chinese-specific. There is no indication that the user can opt into another language or that this locale restriction is documented as a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file’s user-facing natural-language description is entirely in Chinese and presents the tool as a general screenshot utility, with no indication that Chinese is optional or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The HTML root element sets lang="zh-CN", and the visible template text is also fixed in Chinese, which indicates the skill output is constrained to a specific language/locale. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code creates an output directory and writes a new HTML file, which is a file-system modifying operation. While the script prints the output path after completion, it does not disclose beforehand in comments or user-facing messaging that running it will create files under the outputs directory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The HTML root sets lang="zh-CN", which hard-codes a specific language/locale. Under the policy rule, forcing a locale without user opt-in or documented region-specific justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.